Arkose Labs

Overview

Arkose Labs is a San Francisco-based fraud prevention and bot mitigation platform founded in 2017. It specialises in protecting high-value account actions — login, registration, checkout, and password reset flows — from automated attacks including credential stuffing, account takeover (ATO), fake account creation, payment fraud, and scraping. Arkose Labs is deployed by major enterprises across financial services, gaming, social media, and e-commerce, including companies such as Microsoft, Roblox, and PayPal. Its enforcement mechanism relies on adaptive interactive challenges (MatchKey, GameKey) that are computationally expensive for bots to solve but remain usable for legitimate users.

What This Script Does

The Arkose Labs enforcement script loads from client-api.arkoselabs.com and performs continuous, transparent device and behaviour analysis while the user interacts with a protected form or action flow.

Device intelligence collected:

• Browser fingerprint: user agent, installed fonts, canvas fingerprint, WebGL renderer string, available plugins
• Hardware signals: screen resolution, colour depth, device memory (if available), CPU core count
• Network metadata: IP address, connection type indicators
• Timezone and language settings
• JavaScript execution environment characteristics (detecting headless browsers, automation frameworks like Selenium or Puppeteer)

Behavioural biometrics monitored:

• Mouse movement paths and velocity during form interaction
• Keystroke timing patterns (dwell time, flight time between keystrokes)
• Touch event characteristics on mobile devices
• Navigation speed and interaction cadence
• Scroll and click patterns that differentiate human from automated input

Cookies and storage:

• arkose_session — Session-scoped token associating the challenge response with the current form submission; transmitted to the Arkose Labs verification API to validate the challenge was completed legitimately; expires at session end.
• No persistent cross-session tracking cookies are set for advertising or analytics purposes. Device signals are processed server-side for risk scoring without long-term client-side storage.

Script filenames and CDN: api.js loaded from client-api.arkoselabs.com. Challenge assets (game images, audio for accessibility) served from Arkose Labs' Cloudflare-backed CDN. Risk score verification calls go to verify-api.arkoselabs.com.

Consent & Compliance

Arkose Labs is classified under the essential category. Its sole function is security and fraud prevention — protecting the website operator and its legitimate users from automated attacks and account takeover. Under GDPR Recital 47, fraud prevention constitutes a legitimate interest of the data controller, and the ePrivacy Directive's strictly necessary exemption applies to security measures protecting the requested service. The device fingerprinting and behavioural analysis performed by Arkose Labs is bounded to security risk scoring and is not shared with advertising networks or used for user profiling beyond fraud prevention. Arkose Labs participates in the EU-US Data Privacy Framework for data transfer compliance.

Should You Block This Without Consent?

No. Arkose Labs is a security tool that protects against bot attacks, credential stuffing, and payment fraud. It operates as an essential script protecting form submissions and account actions, and does not require consent to load.